Intel Xeon D / Xeon Scalable system firmware, Server Board and Server System: A buffer overflow in system firmware

Impact

A buffer overflow in system firmware across Xeon D and Xeon Scalable server boards, letting a privileged user escalate into firmware. Affects the exact generations that built out the first wave of GPU datacenter capacity, and many of those nodes are still running.

Who can reach it

Privileged local access on the host.

What to do

Fixed in platform BIOS/UEFI firmware. That means an OEM release, a per-node drain, a flash and a cold reboot - and OEM availability commonly lags the Intel advisory by quarters on server boards. There is no microcode or OS-level shortcut for this class; budget it as a fleet-wide maintenance campaign, not a patch.

References

Related entries

• Intel SGX / dynamic voltage and frequency scaling interface: Undervolting the CPU through the privilegedCVE-2019-11157 · Intel SGX / dynamic voltage and frequency scaling interfaceMedium
• NVIDIA DGX BMC (AMI firmware): The BMC does not validate the RSA-1024 public key used to verify firmware signaturesCVE-2020-11488 · NVIDIA DGX BMC (AMI firmware)Medium
• GRUB2 (cutmem command): The cutmem command was not gated by Secure Boot lockdown, so a privileged user could carveCVE-2020-27779 · GRUB2 (cutmem command)Medium
• Intel Ethernet 700 Series Controller firmware (access control): Insufficient access control inside 700-series NICCVE-2020-8692 · Intel Ethernet 700 Series Controller firmware (access control)Medium
• Intel BIOS firmware: Insufficient control-flow management in Intel BIOS firmware lets a privileged user escalateCVE-2021-0157 · Intel BIOS firmwareMedium
• Intel SGX SDK (asynchronous exit / exception handling): SmashEx: an asynchronous exception delivered at the rightCVE-2021-0186 · Intel SGX SDK (asynchronous exit / exception handling)Medium